State hackers from the so-called Sandworm group, which are said to have ties to Russia, have attacked German public broadcasters such as ZDF and WDR, according to Der Spiegel sources. There is a possibility that data was stolen.
Der Spiegel relies on its own sources within the security world and writes that the broadcasters would have been attacked at the beginning of June. Although the attack was recognized at an early stage, it is possible that data may have been stolen. WDR declined to answer questions from the magazine. ZDF confirmed that an attack had taken place and that ten systems had been affected. However, no information was allegedly stolen.
The German Homeland Security Service had warned earlier this month of “particularly sophisticated attacks” on German media organizations and companies engaged in chemical weapons research. The attacks are said to consist of targeted phishing emails with malicious Word documents. There would be similarities between this campaign and the Olympic Destroyer campaign that focused on the Olympics.
The security service attributes the current campaign to Sandworm, a group that has been active since 2013 and would also be known as BlackEnergy. That name has again been associated with attacks on the Ukrainian electricity grid. It wouldn’t be the first time state hackers have targeted broadcasters. In 2015, for example, there was an attack on the French channel TV5 Monde, which was attributed to Russia by German security services.